Discovering Domain Group Membership for an Account

Today was not the first time that I’ve had to verify that BizTalk service accounts were in the right domain groups, but didn’t have access to AD to check.  Fortunately a bit of time with Dr. Google unearthed this command line tool:

net user {username} /domain

This will output all the domain groups that the account belongs to, along with quite a bit of other information:

The request will be processed at a domain controller for domain <MyDomain>
User name                    dan.toomey
Full Name                    Dan Toomey
Comment
User's comment
Country code                 000 (System Default)
Account active               Yes
Account expires              Never
Password last set            14/05/2010 1:43:42 PM
Password expires             Never
Password changeable          17/05/2010 1:43:42 PM
Password required            Yes
User may change password     Yes
Workstations allowed         All
Logon script                 Logon.bat
User profile
Home directory
Last logon                   13/03/2013 7:52:58 AM
Logon hours allowed          All
Local Group Memberships
Global Group memberships     *All Staff            *DomainUsers
                             *Biztalk TFS Contribut*SSO Administrators
                             *Projects_Team        *Biztalk Admins

The command completed successfully.

Now I don’t have to spend time searching for this anymore! 🙂